Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#61

Post by tqkxzugoaupvwqr »

netsharc wrote: post #34
davismwfl wrote: post #2

Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

Reminds me of TSB (UK bank) that asks, in addition to username and password, for three characters of a string when you sign in. Which is stupid because you can’t do it in your head easily. You actually need to see it written down somewhere when they ask for the 3rd, 11th and 15th character of that “memorable information”.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#63

Post by plsdonthack »

Urgo wrote: post #45

If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted.. but.. something doesn't look right here.. OP is a throwaway account created today, which I can understand for this type of thing.. but... they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but... when asked what the bank name was in the comments they were not shy at naming it.. So…

Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, , etc. You can verify that yourself.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#64

Post by chrismatheson »

lpilot wrote: post #38

Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.

Is it not possible to verify positional characters without storing in plain text ?

off the top of my head, something like storing your full password salted + hashed along side each char salted + hashed.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#65

Post by zxcvbn4038 »

There is not much you can do, I’ve tried to inform banks of security issues in the past and all that happens is you get a form letter saying thanks for writing we are doing that on purpose for reasons we can’t explain to you and we’re not interested in outside help. Synchrony and Citibank, I’m looking at you.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#66

Post by perpetualpatzer »

plsdonthack wrote: post #63
Urgo wrote: post #45

If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted.. but.. something doesn't look right here.. OP is a throwaway account created today, which I can understand for this type of thing.. but... they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but... when asked what the bank name was in the comments they were not shy at naming it.. So…

Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, , etc. You can verify that yourself.

This is weak evidence as these rules could be implemented at the point of new password entry, prior to encryption/storage.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#67

Post by anonsivalley652 »

jonplackett wrote: post #49

Banking security is a joke. My bank calls me to talk to me and insists I give them my date of birth and address to ‘verify’ myself. Meaning anyone can call me, pretend to be my bank, I am supposed to give them this info, and then they have what they need to verify themself as me. Banks are dumb.

I did some tech consulting with some ex-banking Wall St. consultants. It's not a monolith. That industry is very conservative.. and some companies get so frozen in time that they become complacent and go full Equifax. They're always playing catch-up because every criminal and most people would like to rob a bank without a gun, so their threats are numerous and perpetual. (And then there's Wells Fargo.)

It seems like banks should adopt that credit-file-based challenge protocol with the multiple choice questions containing ~50% or so spurious data that answers (None of these). I had to do it to reset a hospital's patient login for myself the other day.

DOB, SSN, address, phone number aren't secret-enough "things you know" or "things you can do." For signatures, I always sign a smiley face because they're completely worthless.

Perhaps even better would be to:

0. have the bank have a relationship with the customer

1. issue 2FA device or soft-2FA

2. use per-customer colors, pictures and words on the password screen to deter impersonation and phishing attacks

3. It seems like hardware is so cheap these days, the bank could issue customers a hardened tablet with a pin, biometrics & face recognition that VPN'ed back to them and functioned only for their banking apps. It's much easier to support and harden one controlled device than zillions of likely malware-infected Chrome on Windows 10 or macOS Catalina's Safari on unsecured public WiFi.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#68

Post by kgwxd »

plsdonthack wrote: post #63
Urgo wrote: post #45

If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted.. but.. something doesn't look right here.. OP is a throwaway account created today, which I can understand for this type of thing.. but... they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but... when asked what the bank name was in the comments they were not shy at naming it.. So…

Unfortunately I'm not awake at all hours of the day to respond to internet comments. But if you want further evidence that their passwords are indeed stored in plaintext, consider that their password rule prohibits the special characters !, /, \, , etc. You can verify that yourself.

I once used a small DNS hosting provider where I used a password ending in '!!'. I was in the process of attempting to transfer the domain to another host but it was taking them days, and they communicated several times they were having odd issues specifically with my account. In that same time I was learning how to use Linux and MySQL, and ran into issues using the same password for the MySQL admin during a command line install. That's when I learned !! is short for "run last command". Took me a few more days to think maybe that's what was causing issues at the host provider, so I changed it, told them what I did, and asked to please try the transfer again, and it worked. I never got confirmation the password had anything to do with it, but I let support know my suspicions.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#69

Post by peteri »

netsharc wrote: post #34
davismwfl wrote: post #2

Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

First Direct do this (but they've been that way for ever) for phone calls (better than me reading out my full password over the phone) along with a couple of secret question answers (I'm pretty sure customer support can't see the whole thing).

Online they are now forcing a one time PIN from a token generated from amount + last four digits of destination account.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#70

Post by wtmt »

_Understated_ wrote: post #62

Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.

This is the best way to go about it if people at the bank aren’t responding. Nobody likes a PR nightmare, and Brian Krebs can handle this better with the right people if the OP provides enough evidence.
Post reply on HN